Removing the acquisition wrapper from an object (Python script)
Hi, aq_base(someObject) doesn't work in a python script. I need to get an object without its acquisition wrapper. Any hint ? Many thanks in advance --Gilles
On Thursday 01 Aug 2002 12:49 pm, Gilles Lenfant wrote:
Hi,
aq_base(someObject) doesn't work in a python script. I need to get an object without its acquisition wrapper.
It cant be done in untrusted code, because it would let you strip away its security settings. You could write an external method, or similar trusted code.
----- Original Message ----- From: "Toby Dickenson" <tdickenson@geminidataloggers.com> To: "Gilles Lenfant" <gilles@pilotsystems.net>; <zope-dev@zope.org> Sent: Thursday, August 01, 2002 1:46 PM Subject: Re: [Zope-dev] Removing the acquisition wrapper from an object (Python script) On Thursday 01 Aug 2002 12:49 pm, Gilles Lenfant wrote:
Hi,
aq_base(someObject) doesn't work in a python script. I need to get an object without its acquisition wrapper.
It cant be done in untrusted code, because it would let you strip away its security settings.
You could write an external method, or similar trusted code.
Thanks Toby I can't understand that reason because it's also easy to strip away an object's security settings in an untrusted python script that has a Manager proxy. Well, I'm gonna make my 2 or 3 lines External method :( Cheers --Gilles
On Thursday 01 Aug 2002 2:44 pm, Gilles Lenfant wrote:
I can't understand that reason because it's also easy to strip away an object's security settings in an untrusted python script that has a Manager proxy. Well, I'm gonna make my 2 or 3 lines External method :(
If thats true, its a bug. a serious one too. Please file an example in the collector
----- Original Message ----- From: "Toby Dickenson" <tdickenson@geminidataloggers.com> To: "Gilles Lenfant" <gilles@pilotsystems.net>; <zope-dev@zope.org> Sent: Thursday, August 01, 2002 3:51 PM Subject: Re: [Zope-dev] Removing the acquisition wrapper from an object (Python script) On Thursday 01 Aug 2002 2:44 pm, Gilles Lenfant wrote:
I can't understand that reason because it's also easy to strip away an object's security settings in an untrusted python script that has a Manager proxy. Well, I'm gonna make my 2 or 3 lines External method :(
If thats true, its a bug. a serious one too. Please file an example in the collector
Toby, It's definitively *NOT* a bug but a feature that's completely documented. Most Zope objects inherit of RoleManager class. This class has (among others) this method : manage_permission(self, permission_to_manage, roles=[], acquire=0, REQUEST=None) Just use this method in an "untrusted" python script on any Zope object, add to it Manager proxy, and you're done. --Gilles
Gilles Lenfant wrote:
manage_permission(self, permission_to_manage, roles=[], acquire=0, REQUEST=None)
Just use this method in an "untrusted" python script on any Zope object, add to it Manager proxy, and you're done.
That method just tweaks the permissions settings. It certainly doesn't let you strip off the acquisition wrappers (and hence security settings). Please give examples :-) cheers, Chris
----- Original Message ----- From: "Chris Withers" <chrisw@nipltd.com> To: "Gilles Lenfant" <gilles@pilotsystems.net> Cc: "Toby Dickenson" <tdickenson@geminidataloggers.com>; <zope-dev@zope.org> Sent: Thursday, August 01, 2002 6:18 PM Subject: Re: [Zope-dev] Removing the acquisition wrapper from an object (Python script)
Gilles Lenfant wrote:
manage_permission(self, permission_to_manage, roles=[], acquire=0, REQUEST=None)
Just use this method in an "untrusted" python script on any Zope object, add to it Manager proxy, and you're done.
That method just tweaks the permissions settings. It certainly doesn't let you strip off the acquisition wrappers (and hence security settings).
Please give examples :-)
cheers,
Chris
Chris, There's some misunderstanding: I was formerly looking for a way to get rid of the acquisition wraper of an object from an untrusted python script. Toby Dickenson replied me that aq_base (as opposite to aq_parent) is not part of the acquisition utilities available from an untrusted python script because it "enables to tweak the object's security settings". I replied there are ways to tweak permission settings of an object from a python script with a Manager proxy. I didn't say in any way that it's possible to remove the acquisition wrapper of an object with obj.manage_permission(...) of course :)) That's all ! Now I'm always looking for an alternate way to get rid of the acquisition wrapper and access only the objects own props. TIA --Gilles
On Thu, 2002-08-01 at 14:38, Gilles Lenfant wrote:
[...] Now I'm always looking for an alternate way to get rid of the acquisition wrapper and access only the objects own props.
To access an object's own props (and get an error if it doesn't find them instead of looking up the aq-chain) you don't need to remove it's acquisition wrappers, you just need to tell him not to use acquisition implicitly. The way you do that is to ask the object for a non-implicit-acquisition version of itself, that is, an explicit acquisition object: non_implicit_obj = obj.aq_explicit obj.some_attr or just: obj.aq_explicit.some_attr for short. This way, 'some_attr' won't be looked up in the object's acquisition chain Cheers, Leo -- Ideas don't stay in some minds very long because they don't like solitary confinement.
----- Original Message ----- From: "Leonardo Rochael Almeida" <leo@hiper.com.br> To: "Zope Developers list" <zope-dev@zope.org> Sent: Thursday, August 01, 2002 11:37 PM Subject: Re: [Zope-dev] Removing the acquisition wrapper from an object(Python script)
On Thu, 2002-08-01 at 14:38, Gilles Lenfant wrote:
[...] Now I'm always looking for an alternate way to get rid of the acquisition wrapper and access only the objects own props.
To access an object's own props (and get an error if it doesn't find them instead of looking up the aq-chain) you don't need to remove it's acquisition wrappers, you just need to tell him not to use acquisition implicitly. The way you do that is to ask the object for a non-implicit-acquisition version of itself, that is, an explicit acquisition object:
non_implicit_obj = obj.aq_explicit
obj.some_attr
or just:
obj.aq_explicit.some_attr
Leo, Many thanks, exactly what I needed ! I didn't find much doc about these aq_xxx methods/functions. Where can I find this ? Cheers --Gilles
Why do you say it will not always work? What situations might cause it not to work (Assuming that we already know that the object is acquisition wrapped?) Also, is there any hope of the documentation for acquisition being fleshed out a little and brought up to date? Adrian... -- Adrian Hungate EMail: adrian@haqa.co.uk Web: http://www.haqa.co.uk ----- Original Message ----- From: "Dieter Maurer" <dieter@handshake.de> To: "Gilles Lenfant" <gilles@pilotsystems.net> Cc: "Leonardo Rochael Almeida" <leo@hiper.com.br>; "Zope Developers list" <zope-dev@zope.org> Sent: Friday, August 02, 2002 8:53 PM Subject: Re: [Zope-dev] Removing the acquisition wrapper from an object(Python script)
Gilles Lenfant writes:
...
obj.aq_explicit.some_attr Many thanks, exactly what I needed ! It will not always work, only usually.
Dieter
_______________________________________________ Zope-Dev maillist - Zope-Dev@zope.org http://lists.zope.org/mailman/listinfo/zope-dev ** No cross posts or HTML encoding! ** (Related lists - http://lists.zope.org/mailman/listinfo/zope-announce http://lists.zope.org/mailman/listinfo/zope )
Adrian Hungate writes:
Why do you say it will not always work? What situations might cause it not to work (Assuming that we already know that the object is acquisition wrapped?) You may want to read the "Acquisition" section of
<http://www.dieter.handshake.de/pyprojects/zope/book/chap3.html> You will learn that acquisition wrappers have two components: "aq_self" and "aq_parent", and that an implicit acquisition wrapper first asks "aq_self" and, if unsuccessful, automatically asks "aq_parent" for an attribute lookup, while an explicit wrapper only asks "aq_self". With these explanations you will understand that "hasattr(obj.aq_explicit,*)" is equivalent to "hasattr(obj.aq_base,*)" iff "obj.aq_self" is not itself acquisition wrapped. Dieter
On 8/4/02 2:15 PM, "Dieter Maurer" <dieter@handshake.de> wrote:
Adrian Hungate writes:
Why do you say it will not always work? What situations might cause it not to work (Assuming that we already know that the object is acquisition wrapped?) You may want to read the "Acquisition" section of
<http://www.dieter.handshake.de/pyprojects/zope/book/chap3.html>
You will learn that acquisition wrappers have two components: "aq_self" and "aq_parent", and that an implicit acquisition wrapper first asks "aq_self" and, if unsuccessful, automatically asks "aq_parent" for an attribute lookup, while an explicit wrapper only asks "aq_self".
With these explanations you will understand that "hasattr(obj.aq_explicit,*)" is equivalent to "hasattr(obj.aq_base,*)" iff "obj.aq_self" is not itself acquisition wrapped.
There is also the 'Acquisition' module, which is full of helpful functions that are preferred over going after attributes: Acquisition.aq_base(obj) It deals nicely with unwrapped objects in a cleaner way than the hasattr/getattr combos, and also introduces a powerful 'aq_acquire' function which can be used for fine control. It's documented in: http://www.zope.org//Members/michel/Projects/Interfaces/AcquisitionModuleInt erface -- Jeffrey P Shell www.cuemedia.com
participants (7)
-
Adrian Hungate -
Chris Withers -
Dieter Maurer -
Gilles Lenfant -
Jeffrey P Shell -
Leonardo Rochael Almeida -
Toby Dickenson